[afflom]

Closes #6. Merge remains held behind issue #5 to preserve M0 issue order.

The declared UORC charter pipeline now runs the complete just vv twice in isolated, network-disabled containers using the exact image in prismpm.lock. Setup seals the acquired dependencies separately from current-build proof/application outputs. The harness compares every source-derived projection and returned LexLean build/verification artifact, and executes dependency, setup, adjacent-checkout and host-tool negatives.

Pre-merge review found that artifact and projection parent symlinks could import adjacent evidence. The correction checks every path component and rejects empty, duplicate and escaping projection inventories. Two regression tests reproduced the original failures; the corrected 17-test suite passes without skips. Evidence procedures and red/green results are updated in docs/governance/offline-reproducibility-evidence.md. Universal policy and SDK locks are unchanged.

Validation at 2ac74dc7b59139b578ffdfadbf2ed256a93b5463:

• Local complete just vv passed inside the exact digest-selected SDK after just model-write; generated projections remained unchanged.
• Two local clean roots produced 44 byte-identical canonical artifacts and rejected all nine dependency/tool defects.
• Passed: dual-platform bootstrap checks and full offline checks qualify this revision. All five PR checks passed. Each native offline artifact was independently inspected: two full runs, 44 identical artifacts, exit 0, and no-network execution.
• The earlier dual-platform offline pass applies only to its recorded older revision; it does not substitute for current checks.

This covers the currently declared charter-authority pipeline. It does not establish compression functionality or issue #5's latest-main SDK reconciliation. Any replacement SDK requires rerunning the complete gate on both platforms. PR #72 includes this correction and adds the mandatory capability probes; those probes currently expose unresolved upstream SDK requirements.